What is DORA (Digital Operational Resilience Act)?

How DORA Works

DORA operates through five interconnected pillars mandating specific organizational capabilities. Financial entities must implement comprehensive ICT risk management frameworks with management body accountability, continuous monitoring systems, asset classification protocols, documented business impact analyses, and formalized risk mitigation strategies. Incident response requirements mandate three-tier reporting for major ICT-related incidents: initial notification to competent authorities, intermediate progress reports during remediation, and final root-cause analyses after resolution.

Digital operational resilience testing requires annual vulnerability assessments and scenario-based testing programs. Systemically important financial entities must undergo threat-led penetration testing every three years following the TIBER-EU framework, which simulates advanced persistent threat tactics against production environments. Third-party risk management introduces the strictest requirements. Financial entities must maintain registers of all ICT service arrangements, conduct extensive due diligence on providers, and embed Article 30 contractual provisions covering exit strategies, audit rights, performance targets, and subcontracting conditions.

The regulation creates EU-wide oversight of Critical ICT Third-Party Providers through a two-step designation process. Step one applies quantitative thresholds: providers serving more than 10% of EU financial entities or supporting critical functions for globally systemically important institutions. Step two performs qualitative evaluation of service disruption impact, subcontractor dependencies, and systemic interconnections. Designated CTPPs receive an assigned Lead Overseer from EBA, EIOPA, or ESMA conducting annual oversight plans with enforcement authority including fines up to 1% of average daily worldwide turnover.

Why DORA Matters

DORA shifts EU financial services from capital-based operational risk management to comprehensive digital resilience frameworks. Financial entities previously addressed ICT risk through balance sheet provisions rather than structured prevention and response capabilities.

For IT professionals managing vendor relationships, DORA establishes a reference model for third-party risk governance applicable beyond EU financial services. The Article 30 contractual requirements, CTPP designation criteria, and oversight frameworks demonstrate mature third-party risk management practices applicable to organizations managing critical service provider dependencies regardless of regulatory jurisdiction. Organizations working with managed service providers for compliance requirements face similar contract standardization challenges and oversight frameworks.

Enforcement began January 17, 2025, affecting approximately 22,000 EU financial institutions and their technology partners. Non-EU providers designated as CTPPs must establish EU subsidiaries within one year.

DORA vs. UK Operational Resilience Framework

DORA applies detailed technical standards with specific ICT risk controls and third-party contract requirements, while the UK framework establishes principle-based outcomes allowing firms to determine implementation approaches across operational risks beyond technology.

Common Misconceptions

DORA is not limited to cybersecurity. The regulation addresses comprehensive ICT operational resilience including incident response, business continuity, third-party risk management, and resilience testing, not just security controls.

DORA does not exempt smaller financial entities from all requirements. Article 16 provides proportionality with simplified frameworks for smaller entities, but core obligations for incident reporting, third-party risk management, and basic ICT risk frameworks still apply.